Record Promotion Hold

The promoter says why it is not advancing production, or that it is.

Called by tools/rooster_worker/drain.py's promote_pass -- the one process that can see main's history and so the only thing that knows whether a hold is a designed gate (somebody's own commit ahead of Rooster's fixes; a human-reported fix nobody has verified) or a promotion that simply did not happen. audit.checks.check_promotion_lag reads this (settings_service.PROMOTION_HOLD) and relays the promoter's own reason instead of guessing "waiting only on the script" -- ISS-585 is the build task that guess produced, handed to a builder who cannot promote anything.